CoChat
Sign Up
Cited by 104Smart Grid Security and ResilienceInformation and Cyber SecurityInfrastructure Resilience and Vulnerability Analysis

Quantitative Cyber Risk Reduction Estimation Methodology for a Small SCADA Control System

Open access
McQueen, M.A., Boyer, W.F., Flynn, M.A., Beitel, G.A.·2006·Proceedings of the 39th Annual Hawaii International Conference on System Sciences (HICSS'06)
DOI 10.1109/hicss.2006.405
Open this paper in CoChat — free accountOpen PDF

Abstract

We propose a new methodology for obtaining a quantitative measurement of the risk reduction achieved when a control system is modified with the intent to improve cyber security defense against external attackers. The proposed methodology employs a directed graph called a compromise graph, where the nodes represent stages of a potential attack and the edges represent the expected time-to-compromise for differing attacker skill levels. Time-to-compromise is modeled as a function of known vulnerabilities and attacker skill level. The methodology was used to calculate risk reduction estimates for a specific SCADA system and for a specific set of control system security remedial actions. Despite an 86% reduction in the total number of vulnerabilities, the estimated time-to-compromise was increased only by about 3 to 30% depending on target and attacker skill level.

Integrity signals

Registry

Crossref · 10.1109/hicss.2006.405

Cites

10 of 10 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

We couldn’t retrieve this paper’s full text, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • In ICS and SCADA systems, integrity and availability are highly paramount, while confidentiality is secondary.

    “Among the triad, integrity and availability are highly paramount, while confidentiality is secondary for SCADA systems (Cheminod et al., 2013; McQueen et al., 2006).”

    From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as McQueen et al., 2006

  • Only in two papers, McQueen et al. (2006) and Patel and Zaveri (2010), it is explicitly mentioned that the method was applied to a real system.

    “Only in two papers, namely McQueen et al. (2006) and Patel and Zaveri (2010), it is explicitly mentioned that the method was applied to a real system.”

    From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as McQueen et al. (2006)

  • Objective data required for effective risk estimation in SCADA systems are rarely available, so research often relies on artificial data.

    “The authors of the methods examined point out that data required for the effective estimation of risk are rarely avail-able (Dondossola et al., 2009; McQueen et al., 2006) and, therefore, research often has to rely on artificial data (Luiijf et al., 2009).”

    From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as McQueen et al., 2006

  • Several proposals (Henry and Haimes, 2009; LeMay et al., 2011; McQueen et al., 2006; Patel et al., 2008) perform comparison of risk metrics between different security configurations of a system.

    “There are though several proposals (Henry and Haimes, 2009; LeMay et al., 2011; McQueen et al., 2006; Patel et al., 2008), which we mark with regarding risk evaluation in Table 7, where the comparison of risk metrics is performed between differ-ent security configurations of a system.”

    From A review of cyber security risk assessment methods for SCADA systems (2016) · cites this paper as McQueen et al., 2006

Cites

Flagged first, then by citations

1 of the 11 references couldn’t be matched to a known paper.

Cited by

Sorted by citations

Related

Authors
McQueen, M. A., Boyer, W. F., Flynn, M. A., & Beitel, G. A.
Affiliations
Idaho National Laboratory (US)
Venue
Proceedings of the 39th Annual Hawaii International Conference on System Sciences (HICSS'06)
Publisher
IEEE
Published
2006
Pages
226-226
ISSN
1530-1605 (ISSN-L)
DOI
10.1109/hicss.2006.405
OpenAlex
W2113310679
Cited by
104
References
11
Citations by year
2026: 1 · 2025: 2 · 2024: 5 · 2023: 5 · 2022: 3 · 2021: 3 · 2020: 5 · 2019: 11 · 2018: 6 · 2017: 6 · 2016: 3 · 2015: 8 · 2014: 7 · 2013: 11 · 2012: 3
FWCI
8.56
Type
conference paper
Language
en
Open access
Locations
  • Hawaii International Conference on System Sciences (HICSS) (publishedVersion)
  • OSTI OAI (U.S. Department of Energy Office of Scientific and Technical Information) (submittedVersion)
  • University of North Texas Digital Library (University of North Texas) (submittedVersion)
Topics
  • Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Physical Sciences › Engineering › Civil and Structural Engineering › Infrastructure Resilience and Vulnerability Analysis
Keywords
cyber risk reduction, SCADA systems, vulnerability remediation, directed graph modeling, quantitative risk assessment, industrial control systems

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review